CISA Information Systems Operations and Business Resilience Practice Test 8 — 15 Questions

Question 1

An IS auditor is reviewing a third-party service provider's controls. Which of the following is the MOST important clause to include in the contract to ensure the auditor can assess the provider's controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Right-to-audit clause. A right-to-audit clause (A) is the most important contractual provision because it grants the organization (and its auditors or regulators) the legal right to examine the service provider's controls, records, and facilities. Without it, the auditor has no contractual basis to assess the provider's control environment, making third-party risk assurance impossible. SLAs, exit strategies, and confidentiality clauses address performance, transition, and data protection respectively, but none of them enable control assessment.

Answer

Service level agreement (SLA) with penalties

Answer

Exit strategy clause

Answer

Confidentiality clause

Question 2

An organization uses RAID 5 for its database server. Which of the following is the PRIMARY advantage of RAID 5?

Accepted Answer

Fault tolerance with one disk failure. RAID 5 uses block-level striping with distributed parity, allowing the array to survive a single disk failure without data loss. When one drive fails, the missing data can be reconstructed from parity information stored on the remaining drives. This fault tolerance is the primary advantage for a database server, ensuring availability and data integrity in case of a single disk failure.

Answer

Simplified backup process

Answer

Increased storage capacity without parity overhead

Answer

Improved read performance

Question 3

During an audit of IT asset management, the IS auditor finds that several servers are running an operating system that has reached end-of-life (EOL). The organization has not deployed any compensating controls. Which of the following is the GREATEST risk?

Accepted Answer

Unpatched security vulnerabilities. An operating system that has reached end-of-life (EOL) no longer receives security patches from the vendor. Without compensating controls, any newly discovered vulnerabilities remain unpatched, exposing the organization to exploitation, data breaches, and system compromise. This directly undermines the confidentiality, integrity, and availability of the IT assets, making unpatched security vulnerabilities the greatest risk.

Answer

Incompatibility with new applications

Answer

Increased licensing costs

Answer

Lack of vendor support

Question 4

In ITIL incident management, which severity level typically indicates a critical incident that severely impacts business operations and requires immediate resolution?

Accepted Answer

P1. P1 (Priority 1) incidents are the highest severity, requiring immediate attention.

Answer

P2

Answer

P3

Answer

P4

Question 5

An organization is implementing a software asset management (SAM) program. Which of the following is the PRIMARY benefit of SAM?

Accepted Answer

Ensuring compliance with software licensing agreements. The primary benefit of a software asset management (SAM) program is ensuring compliance with software licensing agreements, which mitigates legal, financial, and reputational risk from unlicensed or over-deployed software. SAM provides visibility into what software is installed, where, and under what license terms, enabling accurate reconciliation of entitlements versus deployments. While SAM can yield cost savings, compliance is the primary driver because non-compliance carries legal penalties and audit exposure.

Answer

Reducing hardware costs

Answer

Automating patch management

Answer

Improving network performance

Question 6

An IS auditor is reviewing a business continuity plan (BCP). Which TWO of the following are key components of the business continuity strategy? (Select two.)

Accepted Answer

Data backup and recovery. Data backup and recovery (B) is a key component of the business continuity strategy because it defines how critical data and systems are restored to meet the recovery point objective (RPO) and recovery time objective (RTO) after a disruption. Alternate facilities (C) is also a key component because the strategy must specify the recovery site options—such as hot, warm, or cold sites, or reciprocal agreements—to resume operations when the primary facility is unavailable. Incident management procedures (A) are part of the incident response and operational response process, not the strategic BCP components themselves. Service desk procedures (D) are operational support activities and do not constitute a continuity strategy element. Change management process (E) governs controlled modifications to the IT environment and is not a BCP strategy component.

Answer

Incident management procedures

Answer

Service desk procedures

Answer

Change management process

Question 7

An organization is planning a full interruption test of its disaster recovery plan. Which THREE of the following should the IS auditor recommend as best practices for this type of test? (Select three.)

Accepted Answer

Notify all relevant stakeholders in advance. Option A is correct because notifying all relevant stakeholders in advance is a best practice for a full interruption test, ensuring that business units, IT staff, and management are aware of the planned outage and can prepare for the disruption, thereby preventing unintended operational impact. Option C is correct because defining clear test objectives and success criteria provides measurable benchmarks for evaluating whether the disaster recovery plan achieves its recovery time objective (RTO) and recovery point objective (RPO), making the test meaningful and auditable. Option D is correct because having a rollback plan in case of failure is essential, as a full interruption test actually shuts down production systems, and if recovery fails, the organization must be able to restore normal operations quickly to avoid extended downtime. Option B is not recommended because conducting the test during peak business hours unnecessarily magnifies risk to critical operations; such tests are typically scheduled during off-peak or maintenance windows. Option E is not recommended because scheduling the test immediately after a major system upgrade introduces unvalidated changes and instability, which could confound test results and increase the risk of failure unrelated to the DR plan itself.

Answer

Conduct the test during peak business hours to simulate real conditions

Answer

Ensure the test is scheduled after a major system upgrade to validate changes

Question 8

An organization has implemented a business continuity plan (BCP) and disaster recovery plan (DRP). During a recent full interruption test, the IT team discovered that the recovery time objective (RTO) for a critical application was not met. What is the MOST likely reason for this failure?

Accepted Answer

The alternate site did not have adequate processing capacity to handle the workload.. The most likely reason the RTO was not met is that the alternate site lacked sufficient processing capacity to handle the workload. RTO measures the time to restore service availability; if the failover site cannot support the required compute, memory, or I/O throughput, restoration will be delayed or fail outright. This is a common capacity planning failure in DR testing, where the alternate site is sized for minimal operations but not for the full production load.

Answer

The recovery point objective (RPO) was set too low, causing data loss.

Answer

The backup data was not encrypted, leading to corruption during restoration.

Answer

The tabletop exercise was not conducted before the full interruption test.

Question 9

An IS auditor is reviewing the ITIL incident management process. Which THREE are the correct priority levels and their typical definitions?

Accepted Answer

P1: Critical impact, immediate response required.. Option A is correct because P1 is the highest priority level in ITIL incident management, reserved for critical impact incidents (e.g., major outages affecting the whole organization) that demand immediate response and often major incident procedures. Option D is correct because P2 represents high-impact incidents requiring an urgent response, typically affecting a significant user group or critical business function but not as catastrophically as P1. Option E is correct because P3 denotes moderate impact incidents handled with a standard response time under normal service desk workflows. Option B is incorrect because P4 is the lowest priority (low impact, minor issue), not a critical-impact level requiring senior management escalation. Option C is incorrect because P2 is not defined as low impact resolved within normal service hours; that description better fits P4 or P3, whereas P2 requires urgent attention.

Answer

P4: Critical impact, requires escalation to senior management.

Answer

P2: Low impact, can be resolved within normal service hours.

Question 10

An organization is implementing a change management process based on ITIL. Which THREE change types should be included in the policy?

Accepted Answer

Emergency change – requires immediate implementation to resolve a major incident.. Option B is correct because ITIL defines an emergency change as one that must be implemented immediately, typically to resolve a major incident or restore a critical service, and it follows an expedited approval path (e.g., Emergency CAB). Option C is correct because a standard change is a pre-authorized, low-risk, routine change with a documented procedure, so it does not require individual CAB review each time. Option E is correct because a normal change is the standard ITIL category that must be assessed and approved by the Change Advisory Board (CAB) before implementation. Option A is incorrect because planned changes are not a distinct ITIL change type and, more importantly, scheduled changes still require appropriate authorization rather than 'no approval needed.' Option D is incorrect because 'major change' is not one of the three ITIL change types; major changes are handled as normal or emergency changes with escalated approval and risk assessment.

Answer

Planned change – scheduled during maintenance windows with no approval needed.

Answer

Major change – requires executive approval and a separate risk assessment.

Question 11

An IS auditor is reviewing the business impact analysis (BIA) for a financial services company. Which THREE metrics are typically defined in a BIA?

Accepted Answer

Recovery point objective (RPO).. The BIA defines the recovery objectives that drive continuity and DR planning: C (Recovery point objective, RPO) specifies the maximum acceptable data loss measured in time before the disruption, determining backup frequency; D (Maximum tolerable downtime, MTD) is the total time a business process can be unavailable before unacceptable impact occurs, and it bounds the recovery strategy; and E (Recovery time objective, RTO) is the target time to restore the process or system after disruption, which must be less than the MTD. These three are business-driven metrics derived from process criticality and impact over time. By contrast, A (MTTR) and B (MTBF) are operational reliability and maintainability metrics of components or systems, not business impact metrics defined in a BIA.

Answer

Mean time to repair (MTTR).

Answer

Mean time between failures (MTBF).

Question 12

An IS auditor is reviewing capacity management practices. Which TWO indicators suggest that proactive capacity management is being performed effectively?

Accepted Answer

Monitoring resource utilization trends over time.. Option C is correct because proactive capacity management depends on continuously collecting and analyzing resource utilization metrics (CPU, memory, disk, network, I/O) over time to identify growth trends and forecast future demand before performance degrades. Option D is correct because configuring threshold alerts for CPU, memory, and disk usage enables early detection of approaching capacity limits, allowing remediation actions to be taken before service levels are impacted. Together, trend monitoring and threshold alerting are the hallmarks of a proactive, forecast-driven capacity management process. Option A is not correct because a BIA is a business continuity/disaster recovery activity that identifies critical processes and recovery requirements, not a capacity management indicator. Option B is not correct because reviewing backup logs addresses backup integrity and recoverability, which is unrelated to capacity planning. Option E is not correct because analyzing historical cost data supports IT financial management and budgeting, not the technical forecasting of resource capacity needs.

Answer

Conducting business impact analysis (BIA) annually.

Answer

Reviewing backup logs for errors.

Answer

Analyzing historical cost data for IT infrastructure.

Question 13

An IS auditor reviewing the backup strategy for a financial application finds that full backups run every Sunday, with daily incremental backups Monday through Saturday. The recovery point objective (RPO) for the application is 4 hours. Which of the following is the MOST significant finding?

Accepted Answer

The backup schedule cannot achieve the 4-hour RPO because incrementals capture changes only once per day.. The recovery point objective defines the maximum acceptable data loss, measured in time. Daily incremental backups leave up to 24 hours of data at risk, far exceeding the 4-hour RPO. The auditor should report that the backup frequency is inadequate. Offsite storage, full backup frequency, and backup type are relevant but do not directly violate the stated RPO in this scenario.

Answer

Incremental backups are more prone to corruption than full backups and should be replaced with differential backups.

Answer

Backup tapes are stored in a cabinet in the data center rather than at an offsite location.

Answer

Full backups are performed weekly, which may be insufficient for recovering large data volumes quickly.

Question 14

An IS auditor is reviewing the deployment pipeline for an organization's e-commerce platform. The pipeline automatically deploys every code commit that passes automated unit tests to production without manual approval. The organization argues this accelerates feature delivery. Which of the following is the auditor's GREATEST concern with this approach?

Accepted Answer

Automated unit tests may not cover all business logic and integration scenarios, allowing defective changes to reach production.. The correct answer is the one highlighting that automated unit tests may not cover all business logic and integration scenarios, allowing defective changes to reach production. In a continuous deployment model, the absence of a manual approval gate shifts the burden of quality assurance entirely to automated tests. If those tests are insufficient, the organization faces significant operational and financial risk.

Answer

Automated deployments increase the cost of infrastructure because they require additional testing environments.

Answer

Developers may not have the authority to approve their own changes, creating a segregation-of-duties conflict.

Answer

The pipeline may not maintain an audit trail of who approved each deployment, violating regulatory requirements.

Question 15

An IS auditor is reviewing the job scheduling function for a mainframe environment that runs nightly batch processing. The auditor finds that the senior operator has standing access to modify production JCL and job schedules without a second approval. Which control should the auditor recommend to BEST mitigate the associated risk?

Accepted Answer

Implement dual control over scheduling changes that affect production jobs.. The core issue is a segregation-of-duties gap: one senior operator can modify production JCL and schedules without independent approval. The most effective mitigation is a preventive control that requires two people to authorize and apply changes. Dual control ensures no single individual can alter critical batch processing, reducing the risk of both errors and fraud. Detective controls like logging are useful but do not stop the change from occurring.

Answer

Enable logging of all JCL modifications and review the logs monthly.

Answer

Require the senior operator to document all schedule changes in a change log.

Answer

Restrict the senior operator's access to read-only for all production JCL.